NKB-S: Network Intrusion Detection Based on SMOTE Sample Generation

This paper mainly studies the problem of sample generation for imbalanced intrusion datasets. The NKB-SMOTE algorithm is proposed based on the SMOTE algorithm by combining the K-means algorithm and using a mixture of oversampling and undersampling methods. The Synthetic Minority Oversampling (SMOTE) Technique sample generation is performed on the minority class samples in the boundary cluster, the Tomek links method is used for the majority class samples in the boundary cluster to undersample the boundary cluster, and the NearMiss-2 method is used to undersample the overall data. Then, multi-classification experiments are conducted on the UNSW-NB15 dataset, and the results show that the proposed NKB-SMOTE algorithm can improve the generation quality of samples and alleviate the fuzzy class boundary problem compared with the traditional SMOTE algorithm. Finally, the actual experiment also verifies the effectiveness of the intrusion detection model based on NKB-SMOTE in real scenarios.